ClawHub
Back to skill

Security audit

Video Toolkit Free

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent local video-processing skill, but it includes unpinned package installation and privileged system install commands without clear manual confirmation boundaries.

Review this skill before installing if your agent may execute setup commands automatically. Install FFmpeg and Whisper yourself, preferably with pinned versions in an isolated environment, and do not let the agent run sudo or pip install commands without explicit approval. Runtime use should be limited to media files you intentionally provide.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:216
Finding

Unpinned Third-Party Package Installation During Environment Check

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 216, 363, and 384
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

At line 216, the environment check automatically installs the package when the whisper command is unavailable:

bash
whisper --version 2>/dev/null || pip install openai-whisper

The dependency and installation instructions are repeated at lines 363 and 384:

text
| Whisper | Subtitle generation | Optional | pip install openai-whisper |
bash
pip install openai-whisper

Technical Analysis

The Skill installs openai-whisper without specifying an audited version, validating package hashes, or using a locked dependency manifest. Consequently, the installed package and its transitive dependencies may change after the Skill has been reviewed.

The command on line 216 is particularly unsafe because it combines an environment check with an automatic state-changing operation. If whisper --version fails for any reason—including the command being absent, incorrectly configured, or inaccessible—the shell executes pip install openai-whisper.

Python package installation can execute package-controlled build and installation logic. If the package distribution or one of its transitive dependencies is compromised, replaced with a malicious release, or resolved from an untrusted package index configured in the environment, attacker-controlled code could execute during installation.

Attack Path

  1. An attacker compromises a future release of openai-whisper, one of its transitive dependencies, or the package source configured for pip.
  2. The Agent follows the environment-check instructions in SKILL.md.
  3. The whisper --version command fails because Whisper is not installed or is unavailable.
  4. The shell evaluates the fallback branch and runs pip install openai-whisper.
  5. pip downloads the current unpinned package and its dep ...[truncated 828 chars]
Remediation
View remediation

Remediation Suggestions

  1. Separate dependency detection from installation. The environment check should only report whether Whisper is available:
bash
whisper --version

  1. Require explicit user confirmation before installing any package. Do not use a shell fallback that silently converts a check into an installation.

  2. Pin Whisper and all transitive dependencies to versions that have been reviewed:

bash
python -m pip install openai-whisper==AUDITED_VERSION
  1. Maintain dependencies in a lock file and require cryptographic hash verification, such as a hash-pinned requirements file installed with:
bash
python -m pip install --require-hashes -r requirements.txt

  1. Install dependencies in an isolated virtual environment rather than the Agent's global Python environment.

  2. Use an explicitly approved package index and prevent environment-level pip configuration from silently redirecting dependency resolution to an untrusted source.

  3. Update all three installation references in SKILL.md so users and Agents consistently follow the hardened installation procedure.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Chaining Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

The chained command 'sudo apt update && sudo apt install ffmpeg' combines multiple privileged operations in one line, which is dangerous in tool-using agent environments because it encourages unattended execution of root-level state changes. Chaining reduces opportunities for review, increases accidental execution risk, and can magnify impact if an agent misfires or if package sources are compromised.

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

md
brew install ffmpeg

# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg

# Windows
winget install Gyan.FFmpeg

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The subtitle-generation examples hard-code --language zh, which directs operation in Chinese by default. This is a natural-language locale constraint presented without offering user choice or documenting that the skill is intended only for Chinese-language media, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file explicitly defines capability coverage using broad keywords such as "核心能力", "when", and phrases like "需要视频处理、音频编辑、媒体转换" without clear activation constraints or exclusion conditions. Such generic phrasing can overlap with common user requests and may cause unintended invocation of the skill outside a narrowly defined video-processing context.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill includes direct installation instructions using sudo, which can lead an agent or user to perform privileged system modifications outside the core video-processing task. In agent-exec contexts, normalizing root-required commands is risky because it expands the blast radius from local media handling to package management and host-level changes.

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

md
brew install ffmpeg

# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg

# Windows
winget install Gyan.FFmpeg

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

L333 声称免费版仅支持单文件处理，这是产品能力边界的一部分；但全文执行方式仅提供通用 ffmpeg/ffprobe/whisper 命令和自然语言驱动说明，L394 也只说“仅处理用户明确提供的视频文件”，并未体现单文件限制。对于一个以文档为执行规范的 Skill，这会让声明的版本边界与实际指导的可执行范围发生偏离。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

L389 说明该 Skill 基于 FFmpeg 和本地 Whisper 运行，不依赖外部 API，整体意图是本地离线处理；但 L403 的错误处理却把网络连通性、代理、防火墙和国内替代方案作为运行问题处理路径，暗示网络是正常执行路径中的重要组成部分。这不是简单遗漏，而是文档层面对运行模式给出了相互冲突的信号。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

L389 明确宣称该 Skill 完全基于本地工具运行且不依赖外部服务，但 L403 要求执行 ping 测试网络连通性，L216/L384 还包含通过 pip 安装 Whisper 的在线依赖获取步骤。这些网络相关操作不属于其描述中的本地视频处理核心行为，因此与“完全本地执行”的表述存在语义不一致。

Content

No source excerpt is available for this finding.